Microsoft Defender Antivirus security intelligence May-2025

[harlan4096]

May-2025 (Platform: 4.18.25050.5 | Engine: 1.1.25050.6)​:

• Security intelligence update version: 1.431.19.0
  
• Release date: June 13, 2025 (Engine) / June 13, 2025 (Platform)
  
• Platform: 4.18.25050.5
  
• Engine: 1.1.25050.6
  
• Support phase: Security and Critical Updates
  

What's new​

• Windows multisession SKUs are now properly classified as client SKUs for signature versioning
  
• EnableDynamicSignatureDroppedEventReporting configuration is now available in Intune (see Event ID 2011)
  
• The display name and description is now displayed correctly for the device control filter driver in Windows services
  
• Improved performance for kernel driver
  
• Improvements to network protection performance related to packet loss during high network utilization
  
• Reliability improvements to network protection during service shutdown
  
• Enriched Event ID 1000 to include ScanOnlyIfIdle and scan priority
  
• Improved device control Windows Portal Device (WPD) device discovery in File explorer. (For more information about device control, see Device control policy samples and scenarios.)
  
• Resolved discrepancy in device health reports between signature publish and signature install date and time
  
• Performance improvements when scanning files/folders with extended attributes
  
• Reliability improvement in the Defender kernel driver to avoid crashing when there's excessive disk input/output
  
• Added exponential backoff support to Core Service 1DS manager telemetry module to address memory consumption and DNS flooding issues
  

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender